A PCI DSS policy on access control should include which of the following?

• A. Defining access needs and privilege assignments for each role
• B. Assigning all privileges to all admin users
• C. Allowing access to privileged IDs for all staff
• D. No documentation required for access control

Answer: (A)

In PCI DSS, the access control policy needs to translate who can access cardholder data into clear, enforceable rules by role. Defining access needs and privilege assignments for each role establishes the minimum privileges required for that role and ties those rights to documented responsibilities. This supports least-privilege access, need-to-know, and accountability, and it provides a solid basis for provisioning, reviewing, and revoking access as people change roles or leave the organization.

The other options undermine security: granting all privileges to all admin users eliminates least-privilege controls; allowing access to privileged IDs for all staff breaks separation of duties and increases risk; and claiming no documentation is required directly contradicts PCI DSS requirements that policies governing access control be documented and maintained.